CVE-2025-24990

What it actually does

This vulnerability affects the third-party Agere modem kernel driver, ltmdm64.sys, that shipped with supported Windows versions. The flaw is associated with unsafe handling of untrusted pointers in kernel-mode driver code, which can allow a locally executing attacker to trigger memory corruption or unsafe kernel memory access and elevate privileges. Because the driver runs in the Windows kernel, successful exploitation can give an attacker SYSTEM-level privileges and the ability to disable security controls, tamper with protected processes, or continue post-exploitation activity with high integrity. Microsoft’s remediation is removal of the driver in the October cumulative update rather than continued support for the affected modem functionality.

Why it matters to the business

An attacker who has already gained a foothold on a Windows system can use this flaw to turn limited access into full control of the machine. This increases the risk of credential theft, security-tool tampering, lateral movement, and operational disruption. The issue is listed in CISA KEV with a remediation due date of 2025-11-04 and is reported as actively exploited in the wild, so remediation should be prioritized even though the EPSS score is moderate. Organizations that still depend on fax modem hardware requiring this driver may face a business tradeoff: patching removes the vulnerable driver but may also break that legacy hardware functionality.

How an attack unfolds

Exploitation typically begins after an attacker obtains local code execution through phishing, malware, exposed remote access, stolen credentials, or another vulnerability. The attacker then runs code on a vulnerable Windows host and interacts with the Agere modem driver, ltmdm64.sys, from user mode. By supplying crafted input that causes the driver to dereference attacker-controlled or otherwise untrusted pointer values, the attacker attempts to influence kernel execution or memory access. If successful, the attacker elevates from a low-privileged or medium-integrity context to SYSTEM/kernel-level control. From there, the attacker can dump credentials, inject into privileged processes, disable endpoint defenses, create persistence, or move laterally. Public reporting marks this as actively exploited in the wild, and the KEV listing means defenders should assume exploitation is realistic where the driver remains present.

How to fix it

Install the Microsoft October cumulative update or later for all supported Windows systems, as this removes the vulnerable ltmdm64.sys driver. Because the vendor remediation removes the driver, identify and retire any dependency on fax modem hardware that requires this specific Agere driver. If immediate patching is not possible, reduce exposure by disabling or removing the driver where present, blocking its load through Windows Defender Application Control or driver block policies, restricting local administrative access, and monitoring for attempts to load or interact with the driver. Treat compensating controls as temporary; the durable remediation is applying the cumulative update that removes the driver.

How to confirm the fix worked

Confirm that affected Windows systems have installed the October cumulative update or a later cumulative update. Validate that ltmdm64.sys is no longer present in C:\Windows\System32\drivers\ and is not loaded in the kernel. Use PowerShell, EDR inventory, or driver inventory tooling to search for ltmdm64.sys across endpoints. Review device and application compatibility requirements for legacy fax modem hardware, because successful remediation may result in that hardware no longer functioning. Where driver-control policies are used as mitigation, test that attempts to load ltmdm64.sys are blocked and logged.

Typical attack path

1. Gain initial local code execution on a Windows endpoint or server using phishing, malware, stolen credentials, or another exploit.
2. Confirm that the vulnerable Agere modem driver ltmdm64.sys is present and loadable on the host.
3. Run exploit code that sends crafted input to the driver and triggers unsafe untrusted pointer handling in kernel mode.
4. Achieve privilege escalation to SYSTEM or equivalent kernel-level control.
5. Disable or bypass security tooling, access protected resources, dump credentials, or deploy additional payloads.
6. Use elevated access for persistence, lateral movement, data theft, or further compromise.

How to detect it

To determine whether exploitation may already have occurred, review EDR, Windows Security, Sysmon, and System logs from systems where ltmdm64.sys was present. Focus on driver-load activity, suspicious local process execution, and privilege changes around the same time. Useful sources include Sysmon Event ID 1 for process creation, Sysmon Event ID 6 for driver load, Security Event ID 4688 for process creation, Security Event ID 4672 for special privileges assigned to a new logon, Service Control Manager events such as 7045 for new service or driver installation, and EDR telemetry showing kernel-driver access or exploit prevention alerts. Look for low-privileged user processes followed by unexpected SYSTEM shells, security-tool termination, LSASS access, credential dumping, creation of new local administrators, or unusual persistence. The strongest exposure indicator is the continued presence or loading of ltmdm64.sys after the Microsoft cumulative update that removes it. Because there are no universally reliable public exploit payload indicators for this issue, prioritize behavioral correlation: a process interacting with or loading the vulnerable driver followed by privilege escalation or post-exploitation actions.

• ltmdm64.sys
• C:\Windows\System32\drivers\ltmdm64.sys
• ImageLoaded: *\ltmdm64.sys
• OriginalFileName: ltmdm64.sys
• Service Control Manager Event ID 7045
• Sysmon Event ID 6
• Security Event ID 4672
• Security Event ID 4688

What your security team should do

• Prioritize remediation on all Windows endpoints and servers because the vulnerability is in CISA KEV, is actively exploited in the wild, and has a KEV due date of 2025-11-04.
• Deploy the October cumulative update or later and verify that ltmdm64.sys has been removed from managed Windows systems.
• Create an enterprise-wide inventory query for ltmdm64.sys and investigate any system where the driver remains present after patching.
• Coordinate with operations teams to identify and replace legacy fax modem workflows that depend on the removed Agere driver.
• Hunt for recent local privilege escalation activity on systems where ltmdm64.sys was present, especially suspicious process creation followed by SYSTEM-level execution.
• Enable or tune driver-load telemetry, such as Sysmon driver load events and EDR kernel-driver visibility, to detect unexpected loading of legacy or removed drivers.
• Restrict local administrator rights and enforce application control to reduce the ability of attackers to stage or abuse vulnerable drivers.
• If exploitation is suspected, preserve volatile evidence, collect EDR process trees, review credential-access activity, and rotate credentials exposed on affected hosts.